2 - Raspberry PI Community Projects

14.3.3.1. Auditing Packages: debsums and its Limits
GOING FURTHER
Protecting against upstream
changes
debsums is useful in detecting changes to files coming from a Debian package,
but it will be useless if the package itself is compromised, for instance if the Debian
mirror is compromised. Protecting against this class of aacks involves
using APT's digital signature verification system (see Section 6.5, “Checking
Package Authenticity” (page 119)), and taking care to only install packages
from a certified origin.
debsums is an interesting tool since it allows finding what installed files have been modified
(potentially by an attacker), but this should be taken with a grain of salt. First, because not
all Debian packages provide the fingerprints required by this program (they can be found in
/var/lib/dpkg/info/package.md5sums when they exist). As a reminder: a fingerprint is a
value, often a number (even though in hexadecimal notation), that contains a kind of signature
for the contents of a file. This signature is calculated with an algorithm (MD5 or SHA1 being wellknown
examples) that more or less guarantee that even the tiniest change in the file contents
implies a change in the fingerprint; this is known as the “avalanche effect”. This allows a simple
numerical fingerprint to serve as a litmus test to check whether the contents of a file have
been altered. These algorithms are not reversible; in other words, for most of them, knowing
a fingerprint doesn't allow finding the corresponding contents. Recent mathematical advances
seem to weaken the absoluteness of these principles, but their use is not called into question
so far, since creating different contents yielding the same fingerprint still seems to be quite a
difficult task.
In addition, the md5sums files are stored on the hard disk; a thorough attacker will therefore
update these files so they contain the new control sums for the subverted files.
The first drawback can be avoided by asking debsums to base its checks on a .deb package instead
of relying on the md5sums file. But that requires downloading the matching .deb files
first:
# apt-get --reinstall -d install `debsums -l`
[ ... ]
# debsums -p /var/cache/apt/archives -g
It is also worth noting that, in its default configuration, debsums automatically generates the
missing md5sums files whenever a package is installed using APT.
The other problem can be avoided in a similar fashion: the check must simply be based on
a pristine .deb file. Since this implies having all the .deb files for all the installed packages,
and being sure of their integrity, the simplest way is to grab them from a Debian mirror. This
operation can be slow and tedious, and should therefore not be considered a proactive technique
to be used on a regular basis.
# apt-get --reinstall -d install `grep-status -e 'Status: install ok
➥ installed' -n -s Package`
[ ... ]
Chapter 14 — Security
385